PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-21640 Siemens CVE debrief

This CVE addresses a null-pointer dereference vulnerability in the Linux kernel's SCTP (Stream Control Transmission Protocol) subsystem, specifically within the `cookie_hmac_alg` sysctl handler. The flaw occurs when the kernel code accesses `current->nsproxy` to obtain network namespace information, which can be NULL when the current task is exiting—such as during `acct(2)` system calls as detected by syzbot. The vulnerability stems from improper namespace handling that could lead to kernel crashes (Oops) with local availability impact. Siemens has identified this as affecting the GNU/Linux subsystem of their SIMATIC S7-1500 TM MFP industrial control product, with no patch currently available. The issue was resolved upstream by obtaining the `net` structure via `container_of()` from `table->data` rather than relying on the potentially unstable `current` pointer.

Vendor
Siemens
Product
SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2024-04-09
Original CVE updated
2026-05-14
Advisory published
2024-04-09
Advisory updated
2026-05-14

Who should care

Industrial control system operators using Siemens SIMATIC S7-1500 TM MFP with the GNU/Linux subsystem enabled; Linux kernel maintainers and distributors packaging SCTP-enabled kernels; OT security teams managing embedded Linux environments in manufacturing and process control facilities

Technical summary

The vulnerability exists in the Linux kernel's SCTP protocol implementation where the `cookie_hmac_alg` sysctl handler incorrectly accesses `current->nsproxy` to determine network namespace context. During task exit sequences, `current->nsproxy` can be NULL, causing a null-pointer dereference and kernel Oops. The affected code path is triggered through sysctl operations on the SCTP HMAC algorithm configuration. The upstream fix replaces the `current`-based namespace lookup with `container_of()` derivation from `table->data`, eliminating the dependency on potentially unstable task state. This represents a class of vulnerability where kernel code assumes `current` is always valid during syscall/sysctl execution, which fails during specific task lifecycle transitions.

Defensive priority

medium

Recommended defensive actions

  • Restrict interactive shell access to the GNU/Linux subsystem to trusted personnel only
  • Build and execute only applications from trusted sources
  • Monitor Siemens security advisories for future patch availability
  • Apply defense-in-depth strategies for industrial control system environments
  • Review network segmentation to limit exposure of affected devices

Evidence notes

The vulnerability description indicates this was discovered by syzbot through automated kernel fuzzing using the acct(2) system call, demonstrating a race condition where `current->nsproxy` becomes NULL during task exit. The fix involves architectural changes to namespace access patterns in SCTP sysctl handlers. Siemens advisory ICSA-24-102-01 tracks this vulnerability with multiple revision updates through 2025, indicating ongoing monitoring of related Linux kernel CVEs for this product line.

Official resources

2024-04-09